CISA Domain 4B-2 Practice Test 002

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain B-2 (System and Operational Resilience) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4B-2 System and Operational Resilience Practice Test 002

10 questions • Single best answer

Question 1

A regional credit union engaged an external audit firm to assess the resilience of its core banking platform. The auditor learns that the platform runs on an active-passive cluster, but both nodes are housed in the same server room and draw power from a single uninterruptible power supply. Which finding is MOST significant?

A. The passive node does not process any production workload during normal operations. B. Failover between the cluster nodes requires manual confirmation by the on-duty operator. C. Both cluster nodes rely on one power supply, creating a shared single point of failure. D. Cluster heartbeat alerts are routed to a shared operations mailbox instead of a pager.

Question 2

A university hospital's IT director tells the IS auditor that network resilience is assured because the hospital contracts with two different telecommunications carriers. Circuit documentation shows that both carriers' lines enter the building through the same underground conduit and terminate at the same local exchange. Which conclusion is MOST appropriate?

A. Carrier diversity lacks route diversity, so one physical event could sever both links. B. Two carriers satisfy the redundancy requirement because their contracts are independent. C. The design is acceptable if both carriers' SLAs guarantee high availability targets. D. The risk is mitigated if each circuit has enough bandwidth to carry the full load.

Question 3

A logistics company runs its shipment-tracking platform in an active-active configuration across two cloud availability zones. To support its resilience assertion, management provides architecture diagrams, the provider's service level agreement, and twelve months of uptime statistics. Which of the following is the BEST evidence that the platform can withstand the loss of one zone?

A. The cloud provider's SOC 2 Type II report covering availability zone infrastructure. B. Architecture diagrams formally approved by the enterprise architecture review board. C. Monitoring dashboards showing 99.99 percent uptime over the past twelve months. D. Results of a recent test in which one zone was disabled and processing continued.

Question 4

A payments company has identified its important business services and set an impact tolerance for each one. During the audit, the IS auditor finds that the tolerances were derived from how quickly IT believes it can restore the underlying systems, rather than from the point at which disruption would cause intolerable harm to customers. Which recommendation is MOST appropriate?

A. Align the disaster recovery plan's recovery time objectives with the current tolerances. B. Redefine the tolerances based on customer and market harm, then test services against them. C. Increase infrastructure redundancy so that IT can restore systems faster than the tolerances. D. Have IT management formally sign off on the tolerances as achievable recovery targets.

Question 5

An IS auditor at a pharmaceutical distributor is evaluating the resilience of its order-fulfillment service. Management states that every application server and database has a redundant counterpart, yet two prior outages were caused by shared components that did not appear in the application inventory. Which audit procedure would BEST identify remaining single points of failure?

A. Trace the service's end-to-end dependencies, including shared infrastructure components. B. Review the hardware maintenance contracts for each server in the application tier. C. Inspect the redundancy settings of each component listed in the asset register. D. Interview system owners about outages their applications experienced this year.

Question 6

A fintech startup hosts all of its customer-facing and back-office services with one cloud provider in a single geographic region. Management asserts that resilience is adequate because workloads are spread across three availability zones within that region. Which risk should the IS auditor highlight as MOST significant to the board?

A. Synchronous replication between availability zones may introduce transaction latency. B. The provider's shared responsibility model may not be fully reflected in the contract. C. A region-wide provider outage could disrupt all critical services at the same time. D. Cloud consumption costs may rise because redundant zones remain continuously active.

Question 7

A county government's IT department reports that the annual failover test of its emergency dispatch system was successful. The IS auditor finds that the test was run at 3 a.m. under minimal load and only confirmed that the secondary server powered on and responded to network pings. What is the IS auditor's BEST course of action?

A. Accept the result, since the test confirmed that the secondary server was operational. B. Report that the test does not show the service can sustain its production workload. C. Independently re-perform the failover test during peak dispatch hours to confirm it. D. Recommend replacing the secondary server with a model that has greater capacity.

Question 8

During an audit of a law firm's document management system, the IS auditor notes that the file server uses RAID 1 disk mirroring. The IT manager states that because every write is mirrored to a second disk, separate backups are no longer necessary. Which response by the IS auditor is MOST appropriate?

A. Agree, because mirroring prevents data loss if a single disk fails unexpectedly. B. Recommend moving to RAID 5 to gain parity-based protection across more disks. C. Recommend replicating the mirrored array to a remote hot site in real time. D. Advise that mirroring copies deletions and corruption, so backups are still needed.

Question 9

A streaming media company operates its platform active-active across two data centers, and each site runs at roughly 70 percent of its capacity during peak viewing periods. Management considers the design fully resilient because traffic automatically reroutes to the surviving site if either one fails. Which finding is MOST significant?

A. The surviving site could not absorb the combined peak load if the other site failed. B. Automatic traffic rerouting may briefly interrupt active viewer sessions during failover. C. Running two active sites adds complexity to change and release management processes. D. Utilization levels suggest capacity planning reports are not reviewed each month.

Question 10

During follow-up on a prior audit at a regional airline's operations center, the IS auditor revisits a finding that the backup generator had never been tested under load. Management provides a vendor invoice showing that the generator received scheduled maintenance last quarter and requests that the finding be closed. What should the IS auditor do NEXT?

A. Close the finding, since the vendor completed the scheduled maintenance service. B. Escalate the finding to the board because remediation is now considered overdue. C. Obtain evidence that the generator was tested under actual facility load conditions. D. Recommend replacing the generator with a newer and more reliable standby unit.

Related Posts

Leave a Comment Cancel Reply